Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2022-29245
Good to know:
Date: May 31, 2022
SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes. When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with a weak random number generator whose seed can be brute forced. This allows an attacker who is able to eavesdrop on the communications to decrypt them. Version 2020.0.2 contains a patch for this issue. As a workaround, one may disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms.
Language: C#
Severity Score
Related Resources (8)
Severity Score
Weakness Type (CWE)
Top Fix
Upgrade Version
Upgrade to version Nao.Tunnel - 1.0.6;Nao.Tunnel - no_fix;dotnet-ssh - no_fix;Unclassified.DotnetSshDeploy - 1.0.0;win-acme - 2.1.23.1315;SolidOps.SubZero.BuildTool - no_fix;SolidOps.SubZero.BuildTool - 1.1.0;SmartSftp - no_fix;NextPlatform.Core.Template - no_fix;SftpCli - no_fix;SshRunAs-Win-x64 - 3.0.1;Tunnel - no_fix;Allowed.Publisher.WindowsServices - no_fix;MediaConnectPlayer - no_fix;Tocsoft.KubeConnect.Tool - 0.0.18;pwshext - no_fix;SicossRecibeador.csproj - no_fix;OctaneSDK - 4.2.0;Thaan.Extension.FTPOperations - no_fix;Inertia.ORM - no_fix;UXSSHPush - no_fix;SSH.NET - 2020.0.2;HIC.RDMP.Plugin - 7.0.14;BlueGoat.MongoUtils - no_fix;SftpCopy - no_fix
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | REQUIRED |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | NONE |
| Availability (A): | NONE |
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | MEDIUM |
| Authentication (AU): | NONE |
| Confidentiality (C): | PARTIAL |
| Integrity (I): | NONE |
| Availability (A): | NONE |
| Additional information: |